linux-toradex.git/drivers/comedi, branch master Linux kernel for Apalis and Colibri modules Merge tag 'char-misc-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 2026-10-25T01:44:26+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-10-25T01:44:26+00:00 330517c63aa9b48227b6ab45f01003effac77ae4 Pull Char/Misc/IIO/others driver updates from Greg KH: "Here is the big set of char/misc/android/iio and other small driver subsystem patches for 7.4-rc1. Loads of stuff in here, larger than normal. Highlights include: - removal of the C binder code, the rust version is stable and will be used going forward in a few billion devices. Great job by those developers - loads and loads of IIO driver updates and feature additions - speakup driver fixes and updates - mhi driver updates - mei driver updates - xillybus driver fixes - comedi driver fixes - lots of coresight driver updates - Interconnect driver updates - nvmem driver updates and fixes - slimbus driver updates and fixes - spmi driver updates and fixes - lots of tiny misc and char driver fixes based on people scanning for things All of these have been in linux-next for a while with no reported issues, other than a merge conflict with one of the rust tree files, which should be simple to resolve" * tag 'char-misc-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (446 commits) rust_binder: wake epoll on self-work queued to poll thread rust_binder: avoid overflow in get_node_debug_info() MAINTAINERS: Add Abel as SPMI co-maintainer spmi: mtk-pmif: Fix clock reference leak in mtk_spmi_bus_probe() iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add() misc: qcom-coincell: Migrate to devm_spmi_subdevice_alloc_and_add() phy: qualcomm: eusb2-repeater: Migrate to devm_spmi_subdevice_alloc_and_add() power: reset: qcom-pon: Migrate to devm_spmi_subdevice_alloc_and_add() nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add() spmi: Add helper to get a parent SPMI device spmi: Implement spmi_subdevice_alloc_and_add() and devm variant spmi: Remove unneeded goto in spmi_device_add() error path spmi: Print error status with %pe format spmi: Remove redundant dev_name() print in spmi_device_add() spmi: Fix potential use-after-free by grabbing of_node reference spmi: mtk-pmif: Add workaround for FSM lockup/error in read operation MAINTAINERS: Add Qualcomm SPMI controller entry spmi: pmic-arb: return 0 in spmi_pmic_arb_register_buses() on success comedi: addi_apci_3xxx: fix subdevice count underallocation ... 
Pull Char/Misc/IIO/others driver updates from Greg KH:
 "Here is the big set of char/misc/android/iio and other small driver
  subsystem patches for 7.4-rc1. Loads of stuff in here, larger than
  normal. Highlights include:

   - removal of the C binder code, the rust version is stable and will
     be used going forward in a few billion devices. Great job by those
     developers

   - loads and loads of IIO driver updates and feature additions

   - speakup driver fixes and updates

   - mhi driver updates

   - mei driver updates

   - xillybus driver fixes

   - comedi driver fixes

   - lots of coresight driver updates

   - Interconnect driver updates

   - nvmem driver updates and fixes

   - slimbus driver updates and fixes

   - spmi driver updates and fixes

   - lots of tiny misc and char driver fixes based on people scanning
     for things

  All of these have been in linux-next for a while with no reported
  issues, other than a merge conflict with one of the rust tree files,
  which should be simple to resolve"

* tag 'char-misc-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (446 commits)
  rust_binder: wake epoll on self-work queued to poll thread
  rust_binder: avoid overflow in get_node_debug_info()
  MAINTAINERS: Add Abel as SPMI co-maintainer
  spmi: mtk-pmif: Fix clock reference leak in mtk_spmi_bus_probe()
  iio: adc: qcom-spmi-iadc: Remove regmap R/W wrapper functions
  iio: adc: qcom-spmi-iadc: Migrate to devm_spmi_subdevice_alloc_and_add()
  misc: qcom-coincell: Migrate to devm_spmi_subdevice_alloc_and_add()
  phy: qualcomm: eusb2-repeater: Migrate to devm_spmi_subdevice_alloc_and_add()
  power: reset: qcom-pon: Migrate to devm_spmi_subdevice_alloc_and_add()
  nvmem: qcom-spmi-sdam: Migrate to devm_spmi_subdevice_alloc_and_add()
  spmi: Add helper to get a parent SPMI device
  spmi: Implement spmi_subdevice_alloc_and_add() and devm variant
  spmi: Remove unneeded goto in spmi_device_add() error path
  spmi: Print error status with %pe format
  spmi: Remove redundant dev_name() print in spmi_device_add()
  spmi: Fix potential use-after-free by grabbing of_node reference
  spmi: mtk-pmif: Add workaround for FSM lockup/error in read operation
  MAINTAINERS: Add Qualcomm SPMI controller entry
  spmi: pmic-arb: return 0 in spmi_pmic_arb_register_buses() on success
  comedi: addi_apci_3xxx: fix subdevice count underallocation
  ...
comedi: addi_apci_3xxx: fix subdevice count underallocation 2026-10-14T12:08:38+00:00 Yang Zi 2959243019@qq.com 2026-10-14T10:11:42+00:00 3de5aa458dede472a253266d02902bd95af8e849 In apci3xxx_auto_attach(), the number of subdevices is computed with     n_subdevices = (board->ai_n_chan ? 0 : 1) + board->has_ao + ... The ternary is inverted: when the board has analog input channels (ai_n_chan != 0), it counts 0 instead of 1, so the AI subdevice that is actually created is not accounted for. As a result comedi_alloc_subdevices() allocates one entry too few, and the later subdevice initialization (notably the TTL Digital I/O subdevice, which is populated last) writes past the end of the allocated array, causing a slab out-of-bounds write. Flip the ternary to count 1 when ai_n_chan is non-zero and 0 otherwise, matching the subdevice creation order in the function. Signed-off-by: Yang Zi <2959243019@qq.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20261014101803.11036-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
In apci3xxx_auto_attach(), the number of subdevices is computed with

    n_subdevices = (board->ai_n_chan ? 0 : 1) + board->has_ao + ...

The ternary is inverted: when the board has analog input channels
(ai_n_chan != 0), it counts 0 instead of 1, so the AI subdevice that is
actually created is not accounted for. As a result
comedi_alloc_subdevices() allocates one entry too few, and the later
subdevice initialization (notably the TTL Digital I/O subdevice, which
is populated last) writes past the end of the allocated array, causing a
slab out-of-bounds write.

Flip the ternary to count 1 when ai_n_chan is non-zero and 0 otherwise,
matching the subdevice creation order in the function.

Signed-off-by: Yang Zi <2959243019@qq.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20261014101803.11036-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers: Replace __MODULE_STRING() with __stringify() 2026-10-14T08:51:18+00:00 Petr Pavlu petr.pavlu@suse.com 2026-10-02T08:31:02+00:00 08abfa5a161e1b6e6244cb2090b0530bc0920798 __MODULE_STRING() has been an alias for __stringify() since "[PATCH] MODULE_PARM support for older modules" [1] in 2002-12. That change also moved it to the graveyard section at the end of linux/module.h Replace the remaining uses of __MODULE_STRING() with __stringify() in preparation for its removal. Link: https://git.kernel.org/tglx/history/c/136839a1b4 [1] Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Acked-by: Andi Shyti <andi.shyti@kernel.org> Acked-by: Ian Abbott <abbotti@mev.co.uk> Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com> Acked-by: Mika Westerberg <westeri@kernel.org> Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com> 
__MODULE_STRING() has been an alias for __stringify() since "[PATCH]
MODULE_PARM support for older modules" [1] in 2002-12. That change also
moved it to the graveyard section at the end of linux/module.h

Replace the remaining uses of __MODULE_STRING() with __stringify() in
preparation for its removal.

Link: https://git.kernel.org/tglx/history/c/136839a1b4 [1]
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Andi Shyti <andi.shyti@kernel.org>
Acked-by: Ian Abbott <abbotti@mev.co.uk>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Mika Westerberg <westeri@kernel.org>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
comedi: pcmuio: validate the IRQs supplied by userspace 2026-10-13T13:53:53+00:00 Yogesh Gaur yogeshgaur.83@gmail.com 2026-09-09T10:48:47+00:00 9c325b21bba99e597771137fc11b9427c86618d8 comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. pcmuio passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. Every interrupt this board can assert is a legacy ISA one, so the ISA range is the right bound; it is also sufficient, because mp_chip_data->isa_irq is set only by alloc_isa_irq_from_domain() and mp_unmap_irq() returns early when it is set. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. This board takes two interrupts, one per ASIC, so options[1] and options[2] both need the check. The existing options[2] == dev->irq case is left alone: it covers both ASICs sharing one interrupt and neither having one, and by then options[1] has already been validated. Fixes: 6baef150380d ("Staging: comedi: add pcmmio and pcmuio drivers") Assisted-by: LLM Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com> Link: https://patch.msgid.link/20260909104848.1763-7-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so
it->options[1] is a number chosen by userspace. pcmuio passes it to
request_irq() without checking it first, which lets an interrupt owned by
another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be
claimed for this board. When the owner of that interrupt is later
released the descriptor is freed while this driver's handler is still
installed on it.

Every interrupt this board can assert is a legacy ISA one, so the ISA
range is the right bound; it is also sufficient, because
mp_chip_data->isa_irq is set only by alloc_isa_irq_from_domain() and
mp_unmap_irq() returns early when it is set.

Bound the value before requesting it, as das16m1.c already does. An
out-of-range value is ignored rather than rejected, so the board still
attaches without interrupt support, exactly as it does today when
request_irq() fails.

This board takes two interrupts, one per ASIC, so options[1] and
options[2] both need the check. The existing options[2] == dev->irq case
is left alone: it covers both ASICs sharing one interrupt and neither
having one, and by then options[1] has already been validated.

Fixes: 6baef150380d ("Staging: comedi: add pcmmio and pcmuio drivers")
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20260909104848.1763-7-yogeshgaur.83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
comedi: pcmmio: validate the IRQ supplied by userspace 2026-10-13T13:53:53+00:00 Yogesh Gaur yogeshgaur.83@gmail.com 2026-09-09T10:48:46+00:00 23c6fc62e754f8bc412ceb5c0d9aaa14f2c9ff31 comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. pcmmio passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. The board's interrupt is routed in software rather than jumpered, and the driver notes that "any IRQ from 1-15 is OK", so the ISA range is exactly the right bound. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. Fixes: 6baef150380d ("Staging: comedi: add pcmmio and pcmuio drivers") Assisted-by: LLM Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com> Link: https://patch.msgid.link/20260909104848.1763-6-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so
it->options[1] is a number chosen by userspace. pcmmio passes it to
request_irq() without checking it first, which lets an interrupt owned by
another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be
claimed for this board. When the owner of that interrupt is later
released the descriptor is freed while this driver's handler is still
installed on it.

The board's interrupt is routed in software rather than jumpered, and the
driver notes that "any IRQ from 1-15 is OK", so the ISA range is exactly
the right bound.

Bound the value before requesting it, as das16m1.c already does. An
out-of-range value is ignored rather than rejected, so the board still
attaches without interrupt support, exactly as it does today when
request_irq() fails.

Fixes: 6baef150380d ("Staging: comedi: add pcmmio and pcmuio drivers")
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20260909104848.1763-6-yogeshgaur.83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
comedi: dmm32at: validate the IRQ supplied by userspace 2026-10-13T13:53:53+00:00 Yogesh Gaur yogeshgaur.83@gmail.com 2026-09-09T10:48:45+00:00 797d56d7f90864e67424f8e82639a9b3aedf37e0 comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. dmm32at passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. Every interrupt this board can assert is a legacy ISA one, so the ISA range is the right bound; it is also sufficient, because mp_chip_data->isa_irq is set only by alloc_isa_irq_from_domain() and mp_unmap_irq() returns early when it is set. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver") Assisted-by: LLM Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com> Link: https://patch.msgid.link/20260909104848.1763-5-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so
it->options[1] is a number chosen by userspace. dmm32at passes it to
request_irq() without checking it first, which lets an interrupt owned by
another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be
claimed for this board. When the owner of that interrupt is later
released the descriptor is freed while this driver's handler is still
installed on it.

Every interrupt this board can assert is a legacy ISA one, so the ISA
range is the right bound; it is also sufficient, because
mp_chip_data->isa_irq is set only by alloc_isa_irq_from_domain() and
mp_unmap_irq() returns early when it is set.

Bound the value before requesting it, as das16m1.c already does. An
out-of-range value is ignored rather than rejected, so the board still
attaches without interrupt support, exactly as it does today when
request_irq() fails.

Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver")
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20260909104848.1763-5-yogeshgaur.83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
comedi: dt2814: validate the IRQ supplied by userspace 2026-10-13T13:53:53+00:00 Yogesh Gaur yogeshgaur.83@gmail.com 2026-09-09T10:48:44+00:00 81026c2b3f9096cdfdfa02918f94865629fb7f90 comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. dt2814 passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. Every interrupt this board can assert is a legacy ISA one, so the ISA range is the right bound; it is also sufficient, because mp_chip_data->isa_irq is set only by alloc_isa_irq_from_domain() and mp_unmap_irq() returns early when it is set. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. Fixes: a211ea977a41 ("Staging: comedi: add dt2814 driver") Assisted-by: LLM Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com> Link: https://patch.msgid.link/20260909104848.1763-4-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so
it->options[1] is a number chosen by userspace. dt2814 passes it to
request_irq() without checking it first, which lets an interrupt owned by
another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be
claimed for this board. When the owner of that interrupt is later
released the descriptor is freed while this driver's handler is still
installed on it.

Every interrupt this board can assert is a legacy ISA one, so the ISA
range is the right bound; it is also sufficient, because
mp_chip_data->isa_irq is set only by alloc_isa_irq_from_domain() and
mp_unmap_irq() returns early when it is set.

Bound the value before requesting it, as das16m1.c already does. An
out-of-range value is ignored rather than rejected, so the board still
attaches without interrupt support, exactly as it does today when
request_irq() fails.

Fixes: a211ea977a41 ("Staging: comedi: add dt2814 driver")
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20260909104848.1763-4-yogeshgaur.83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
comedi: ni_atmio16d: validate the IRQ supplied by userspace 2026-10-13T13:53:53+00:00 Yogesh Gaur yogeshgaur.83@gmail.com 2026-09-09T10:48:43+00:00 71424db0ebb5f484fa3f386910f8ce9da95b8b2e comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. ni_atmio16d passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. The driver already documents which interrupts the board can assert -- "0 == no irq; or 3,4,5,6,7,9,10,11,12,14,15" -- so use exactly that set rather than the whole ISA range. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. Fixes: 2323b276308a ("Staging: comedi: add ni_at_atmio16d driver") Assisted-by: LLM Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com> Link: https://patch.msgid.link/20260909104848.1763-3-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so
it->options[1] is a number chosen by userspace. ni_atmio16d passes it to
request_irq() without checking it first, which lets an interrupt owned by
another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be
claimed for this board. When the owner of that interrupt is later
released the descriptor is freed while this driver's handler is still
installed on it.

The driver already documents which interrupts the board can assert --
"0 == no irq; or 3,4,5,6,7,9,10,11,12,14,15" -- so use exactly that set
rather than the whole ISA range.

Bound the value before requesting it, as das16m1.c already does. An
out-of-range value is ignored rather than rejected, so the board still
attaches without interrupt support, exactly as it does today when
request_irq() fails.

Fixes: 2323b276308a ("Staging: comedi: add ni_at_atmio16d driver")
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20260909104848.1763-3-yogeshgaur.83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
comedi: comedi_parport: validate the IRQ supplied by userspace 2026-10-13T13:53:53+00:00 Yogesh Gaur yogeshgaur.83@gmail.com 2026-09-09T10:48:42+00:00 790ea6844593bcd03b0379986fc821d8c511746e comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. comedi_parport passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. A parallel port asserts a legacy ISA interrupt, so the ISA range is the right bound; it is also sufficient, because mp_chip_data->isa_irq is set only by alloc_isa_irq_from_domain() and mp_unmap_irq() returns early when it is set. syzbot hit this one: remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'comedi_parport' WARNING: fs/proc/generic.c:747 at remove_proc_entry+0x4e7/0x610 fs/proc/generic.c:747 Call Trace: <TASK> unregister_irq_proc+0x206/0x2a0 kernel/irq/proc.c:406 free_desc+0x89/0x330 kernel/irq/irqdesc.c:482 irq_free_descs+0x84/0xc0 kernel/irq/irqdesc.c:865 irq_domain_free_irqs+0x46a/0x5c0 kernel/irq/irqdomain.c:1917 mp_unmap_irq+0xf8/0x130 arch/x86/kernel/apic/io_apic.c:1061 acpi_unregister_gsi_ioapic+0x40/0x60 arch/x86/kernel/acpi/boot.c:722 acpi_pci_irq_disable+0x275/0x360 drivers/acpi/pci_irq.c:517 pci_disable_device+0x130/0x270 drivers/pci/pci.c:2206 pci_device_remove+0xb2/0x1d0 drivers/pci/pci-driver.c:512 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 unbind_store+0xf8/0x110 drivers/base/bus.c:244 </TASK> The leaked /proc entry the warning names is the mild part. mp_chip_data->count tracks GSI mappings rather than request_irq() users, and __setup_irq() takes no reference on the descriptor, so the irq_desc is freed with the comedi irqaction still attached to it. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. Fixes: 241ab6ad7108 ("Staging: comedi: add comedi_parport driver") Reported-by: syzbot+690d666eb12fca6e1e61@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=690d666eb12fca6e1e61 Assisted-by: LLM Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com> Link: https://patch.msgid.link/20260909104848.1763-2-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so
it->options[1] is a number chosen by userspace. comedi_parport passes it to
request_irq() without checking it first, which lets an interrupt owned by
another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be
claimed for this board. When the owner of that interrupt is later
released the descriptor is freed while this driver's handler is still
installed on it.

A parallel port asserts a legacy ISA interrupt, so the ISA range is the
right bound; it is also sufficient, because mp_chip_data->isa_irq is set
only by alloc_isa_irq_from_domain() and mp_unmap_irq() returns early when
it is set.

syzbot hit this one:

	remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'comedi_parport'
	WARNING: fs/proc/generic.c:747 at remove_proc_entry+0x4e7/0x610 fs/proc/generic.c:747
	Call Trace:
	 <TASK>
	 unregister_irq_proc+0x206/0x2a0 kernel/irq/proc.c:406
	 free_desc+0x89/0x330 kernel/irq/irqdesc.c:482
	 irq_free_descs+0x84/0xc0 kernel/irq/irqdesc.c:865
	 irq_domain_free_irqs+0x46a/0x5c0 kernel/irq/irqdomain.c:1917
	 mp_unmap_irq+0xf8/0x130 arch/x86/kernel/apic/io_apic.c:1061
	 acpi_unregister_gsi_ioapic+0x40/0x60 arch/x86/kernel/acpi/boot.c:722
	 acpi_pci_irq_disable+0x275/0x360 drivers/acpi/pci_irq.c:517
	 pci_disable_device+0x130/0x270 drivers/pci/pci.c:2206
	 pci_device_remove+0xb2/0x1d0 drivers/pci/pci-driver.c:512
	 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
	 unbind_store+0xf8/0x110 drivers/base/bus.c:244
	 </TASK>

The leaked /proc entry the warning names is the mild part.
mp_chip_data->count tracks GSI mappings rather than request_irq() users,
and __setup_irq() takes no reference on the descriptor, so the irq_desc
is freed with the comedi irqaction still attached to it.

Bound the value before requesting it, as das16m1.c already does. An
out-of-range value is ignored rather than rejected, so the board still
attaches without interrupt support, exactly as it does today when
request_irq() fails.

Fixes: 241ab6ad7108 ("Staging: comedi: add comedi_parport driver")
Reported-by: syzbot+690d666eb12fca6e1e61@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=690d666eb12fca6e1e61
Assisted-by: LLM
Signed-off-by: Yogesh Gaur <yogeshgaur.83@gmail.com>
Link: https://patch.msgid.link/20260909104848.1763-2-yogeshgaur.83@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
comedi: comedi_bond: Refactor strlcat() to seq_buf in do_dev_config() 2026-10-13T13:53:52+00:00 Bill Wendling morbo@google.com 2026-09-27T06:00:00+00:00 6b795870cf764379a4631b99c3c20dadc206c064 do_dev_config() builds a space-separated list of bonded devices in devpriv->name by formatting each "minor:subdev " pair into a temporary stack buffer with snprintf() and appending it with strlcat() in a loop. In preparation for removing the deprecated strlcat() API[1], use struct seq_buf and seq_buf_printf() to format each entry directly into devpriv->name. This avoids repeated rescanning of devpriv->name and eliminates the temporary buffer. Link: https://github.com/KSPP/linux/issues/370 [1] Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling <morbo@google.com> Signed-off-by: Mariia Nikitash <nikitash.mariiaw@gmail.com> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260927060000.518354-1-nikitash.mariiaw@gmail.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> 
do_dev_config() builds a space-separated list of bonded devices in
devpriv->name by formatting each "minor:subdev " pair into a temporary
stack buffer with snprintf() and appending it with strlcat() in a loop.

In preparation for removing the deprecated strlcat() API[1], use struct
seq_buf and seq_buf_printf() to format each entry directly into
devpriv->name. This avoids repeated rescanning of devpriv->name and
eliminates the temporary buffer.

Link: https://github.com/KSPP/linux/issues/370 [1]
Cc: codemender-patching+linux@google.com
Assisted-by: LLM
Signed-off-by: Bill Wendling <morbo@google.com>
Signed-off-by: Mariia Nikitash <nikitash.mariiaw@gmail.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20260927060000.518354-1-nikitash.mariiaw@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>